Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ae6e339423fa618…

MALICIOUS

PDF

99.2 KB Created: 2021-03-11 12:09:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c0cedc2074145b06f7a45bec1a720f08 SHA-1: 7c0777e0ae46cf20b17820aed4033974680a9628 SHA-256: 8ae6e339423fa6185b9f79099b94ee4ccf72d3ae1e30674f894ddeb0b5a34ead
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'https://mezovuduw.ru/123?utm_term=kali+linux+apk+for+android+free', which is presented as a download for 'kali linux apk for android free'. This suggests a social engineering tactic to trick users into downloading a payload. No scripts were extracted, but the presence of an external URI and the nature of the ClamAV detection strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/123?utm_term=kali+linux+apk+for+android+free
    • https://static.s123-cdn-static.com/uploads/4476768/normal_5febfa32ca72d.pdf
    • http://gamowenugeg.sportsontheweb.net/what_is_a_personal_belief_essay.pdf
    • https://cdn-cms.f-static.net/uploads/4409619/normal_601144cf838fe.pdf
    • https://cdn-cms.f-static.net/uploads/4367279/normal_6049b870d5d98.pdf
    • https://cdn.sqhk.co/vijasezadida/KjcL8mf/74448668043.pdf
    • https://cdn-cms.f-static.net/uploads/4452199/normal_6027f9fa0d21e.pdf
    • https://cdn-cms.f-static.net/uploads/4479254/normal_6026709a49f1d.pdf
    • https://cdn.sqhk.co/zosiwikiw/2DDNkjb/74915674382.pdf
    • https://cdn-cms.f-static.net/uploads/4417327/normal_601bbacc85332.pdf
    • https://cdn-cms.f-static.net/uploads/4387224/normal_600a298f6f9fb.pdf
    • https://cdn-cms.f-static.net/uploads/4410702/normal_5fd126e39dc2e.pdf
    • https://cdn.sqhk.co/filajokajemu/UIwXNib/mobewabiragomedusexuxi.pdf
    • https://cdn.sqhk.co/fafovewidom/iDgfTgc/zolarixulavidujanolafa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://kevarivujez.rf.gd/15100279036.pdf
    • http://gosovugan.epizy.com/xf_autocad_2013_64_bit.pdf
    • http://tapoloferazuziw.atwebpages.com/cambridge_additional_mathematics.pdf
    • http://fosarasopu.rf.gd/what_is_the_most_violent_fighting_style.pdf
    • https://uploads.strikinglycdn.com/files/ef3073f7-831e-4af8-8c1f-0f513820aa4b/cronica_de_una_muerte_anunciada_el_corte_ingles.pdf
    • https://uploads.strikinglycdn.com/files/a3c4987a-2a0d-4557-bc30-1ca45b4e9f95/how_to_find_variable_cost_ratio.pdf
    • http://gebozobab.epizy.com/9835310172.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000120af.bin
f30142a35436949c27c44b2cc9e4f743505031c072a42f302970aa791b3ab786		 pdf-font-stream PDF embedded font (sfnt) at offset 0x120AF 4760 bytes
font_01_sfnt_off000130dd.bin
7e95d7a4662af35b4636190eabfe9c1ee63329304a1c3315b4717dc5ca780cac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x130DD 13088 bytes
font_02_sfnt_off00015a8e.bin
39b2f4b99ee08965fd4836f89f628a00cde8346cb181131bba0308e80db8fb67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15A8E 16092 bytes
font_03_sfnt_off00016f55.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16F55 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.